chore(infra): route electric through ingest's ALB instead of its own - #1266

🟢 Confidence 4/5 · likely safe to merge
service.url must still resolve without public: true, since both hostnames' CNAMEs come from it and the vendored alchemy source cannot confirm it.
_{quality 98/100 · 1 note · tests not needed · risk high · 2/2 new units observable}

Moves both regional ingress paths onto ingest's single ALB: ingest owns the load balancer and listener, electric attaches a host rule and its own SNI certificate. The wiring reads correctly and the doc drift is the only defect I could confirm; the alchemy assumptions are unverifiable here.

• createMapleIngest now owns AWS.ELBv2.LoadBalancer/Listener (ingest-lb, ingest-listener) and forwards to ingest at priority 50000
• createMapleElectric takes ingest's listener, albSecurityGroupId and a required hostname, dropping public: true and its own ALB group
• alchemy.run.ts creates electric only when domains.electric is set, and does not deploy it in previews or dev

Findings

_{53fb08b · Updated on every push. Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}